The --quiet option does not suppress stderr when a command-line parsing error
occurs.  When this happens, the parse() method throws an exception (as it
should) without processing any command-line options.  Here's the parse() method
for reference:

protected final void parse() throws Exception {

    CommandLineParser parser = new PosixParser();
    this.commandLine = parser.parse(this.options, this.args, false);
    Option[] options = this.commandLine.getOptions();

    StringBuffer b = new StringBuffer();
    for (int i = 0; i < options.length; i++) {
        b.append(options[i].getLongOpt() + " ");
    }
    logger.info("Options processed: " + b.toString());

    if (this.commandLine.hasOption(DEBUG.getOpt())) {
        this.debug = true;
        setDebugLogLevel();
        logger.debug("Option debug set");
    } else {
        logger.debug("Option debug not set");
    }
    if (this.commandLine.hasOption(QUIET.getOpt())) {
        this.quiet = true;
        logger.debug("Option quiet set");
    } else {
        logger.debug("Option quiet not set");
    }

    this.validate();
}

I tried changing the 3rd argument of parser.parse to true

this.commandLine = parser.parse(this.options, this.args, true);

but experiments suggest the parse fails in this case.  In fact,
SAMLAssertionIssuerToolTest fails with the following exception:

Testsuite: org.globus.gridshib.tool.saml.SAMLAssertionIssuerToolTest
Tests run: 1, Failures: 0, Errors: 1, Time elapsed: 0.881 sec

Testcase: testInstallation took 0.881 sec
    Caused an ERROR
exception encoding TBS cert - java.lang.NumberFormatException: For input
string: "--"
java.lang.SecurityException: exception encoding TBS cert -
java.lang.NumberFormatException: For input string: "--"
    at
org.bouncycastle.jce.X509V3CertificateGenerator.generateX509Certificate(X509V3CertificateGenerator.java:330)
    at
org.bouncycastle.jce.X509V3CertificateGenerator.generateX509Certificate(X509V3CertificateGenerator.java:229)
    at
org.globus.gsi.bc.BouncyCastleCertProcessingFactory.createProxyCertificate(BouncyCastleCertProcessingFactory.java:636)
    at
org.globus.gsi.bc.BouncyCastleCertProcessingFactory.createCredential(BouncyCastleCertProcessingFactory.java:278)
    at
org.globus.gridshib.security.util.GSIUtil.createCredential(GSIUtil.java:408)
    at
org.globus.gridshib.security.util.GSIUtil.createCredential(GSIUtil.java:299)
    at
org.globus.gridshib.security.util.GSIUtil.createCredential(GSIUtil.java:274)
    at
org.globus.gridshib.tool.x509.X509BindingTool.run(X509BindingTool.java:152)
    at
org.globus.gridshib.tool.saml.SAMLAssertionTestingTool.run(SAMLAssertionTestingTool.java:183)
    at
org.globus.gridshib.tool.saml.SAMLAssertionVerifyTool.run(SAMLAssertionVerifyTool.java:115)
    at org.globus.gridshib.common.cli.BaseCLI.getExitCode(BaseCLI.java:195)
    at
org.globus.gridshib.tool.saml.SAMLAssertionIssuerToolTest.testInstallation(SAMLAssertionIssuerToolTest.java:79)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

Looking at the logs, it appears that the following call is the culprit:

X509BindingTool cli = 
  new X509BindingTool(new String[]{"--debug", "--oid", oid, inOpt});
cli.run();

For some strange reason, the parser is gobbling up the remainder of the command
line after the "--oid" option.